CVE-2023-45285
Fixed in a distro release EPSS 1%
Using go get to fetch a module with the ".git" suffix may unexpectedly fallback to the insecure "git://" protocol if the module is unavailable via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE is not set for said module. This only affects users who are not using the module proxy and are fetching modules directly (i.e. GOPROXY=off).
Products: Go toolchain cmd/go
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | toolchain | 1.20.12 |
| Go | toolchain | 1.21.5 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | delve | 1.20.2-1.module_el8.9.0+3642+43318da8 |
| AlmaLinux 8 | go-toolset | 1.20.12-1.module_el8.9.0+3728+f1d47c6f |
| AlmaLinux 8 | golang | 1.20.12-2.module_el8.9.0+3728+f1d47c6f |
| AlmaLinux 8 | golang-bin | 1.20.12-2.module_el8.9.0+3728+f1d47c6f |
| AlmaLinux 8 | golang-docs | 1.20.12-2.module_el8.9.0+3728+f1d47c6f |
| AlmaLinux 8 | golang-misc | 1.20.12-2.module_el8.9.0+3728+f1d47c6f |
| AlmaLinux 8 | golang-src | 1.20.12-2.module_el8.9.0+3728+f1d47c6f |
| AlmaLinux 8 | golang-tests | 1.20.12-2.module_el8.9.0+3728+f1d47c6f |
| AlmaLinux 9 | go-toolset | 1.20.12-1.el9_3 |
| AlmaLinux 9 | golang | 1.20.12-1.el9_3 |
| AlmaLinux 9 | golang-bin | 1.20.12-1.el9_3 |
| AlmaLinux 9 | golang-docs | 1.20.12-1.el9_3 |
| AlmaLinux 9 | golang-misc | 1.20.12-1.el9_3 |
| AlmaLinux 9 | golang-src | 1.20.12-1.el9_3 |
| AlmaLinux 9 | golang-tests | 1.20.12-1.el9_3 |
| Chainguard | aactl | 0.4.12-r5 |
| Chainguard | amass | 4.2.0-r3 |
| Chainguard | aws-flb-cloudwatch | 1.9.4-r6 |
| Chainguard | aws-flb-firehose | 1.7.2-r6 |
| Chainguard | aws-flb-kinesis | 1.10.2-r6 |
| Chainguard | bank-vaults-fips | 1.20.4-r3 |
| Chainguard | cass-operator | 1.18.2-r3 |
| Chainguard | cass-operator-fips | 1.18.2-r1 |
| Chainguard | cni-plugins | 1.4.0-r1 |
| Chainguard | cni-plugins-fips | 1.4.0-r1 |
| Chainguard | configmap-reload | 0.12.0-r3 |
| Chainguard | configmap-reload-fips | 0.12.0-r2 |
| Chainguard | configmap-reload-fips-0.11 | 0.11.1-r3 |
| Chainguard | cortex | 1.16.0-r1 |
| Chainguard | ctop | 0.7.7-r10 |
| Chainguard | dgraph | 23.1.0-r4 |
| Chainguard | docker-cli | 24.0.6-r1 |
| Chainguard | docker-credential-ecr-login | 0.7.1-r8 |
| Chainguard | flannel-cni-plugin | 1.2.0-r5 |
| Chainguard | fulcio-fips | 1.4.3-r1 |
| Chainguard | gke-gcloud-auth-plugin | 0.0.2-r6 |
| Chainguard | go-bindata | 3.1.3-r15 |
| Chainguard | go-licenses | 1.6.0-r8 |
| Chainguard | go-md2man | 2.0.3-r1 |
| Chainguard | gobuster | 3.6.0-r4 |
| Chainguard | gops | 0.3.28-r4 |
| Chainguard | gosu | 1.17-r2 |
| Chainguard | grpcurl | 1.8.9-r2 |
| Chainguard | helm-push | 0.10.4-r1 |
| Chainguard | hey | 0.1.4-r9 |
| Chainguard | hubble-ui-backend | 0.13.3-r1 |
| Chainguard | influx | 2.7.3-r8 |
| Chainguard | ip-masq-agent | 2.9.3-r6 |
| Chainguard | jsonnet-bundler | 0.5.1-r1 |
| Chainguard | k3d | 5.6.0-r5 |
| Chainguard | katib-earlystopping | 0.19.0-r31 |
| Chainguard | katib-suggestion-goptuna-compat | no fix |
| Chainguard | katib-suggestion-hyperband | 0.19.0-r31 |
| Chainguard | katib-suggestion-hyperopt | 0.19.0-r31 |
| Chainguard | katib-suggestion-hyperopt | 0.19.0-r40 |
| Chainguard | katib-suggestion-nas-darts | 0.19.0-r31 |
| Chainguard | katib-suggestion-nas-enas | 0.19.0-r31 |
| Chainguard | katib-suggestion-optuna-enas | 0.19.0-r31 |
| Chainguard | katib-suggestion-pbt-enas | 0.19.0-r31 |
| Chainguard | katib-suggestion-skopt-enas | 0.19.0-r31 |
| Chainguard | katib-tfevent-metricscollector | 0.19.0-r31 |
| Chainguard | kind | 0.21.0-r0 |
| Chainguard | kube-logging-logging-operator-4.1 | 4.1.0-r3 |
| Chainguard | kubernetes-csi-livenessprobe-2.10 | 2.10.0-r4 |
| Chainguard | kubernetes-csi-livenessprobe-fips | 2.11.0-r4 |
| Chainguard | kubernetes-csi-livenessprobe-fips-2.10 | 2.10.0-r4 |
| Chainguard | kubernetes-dashboard-metrics-scraper | 1.0.9-r10 |
| Chainguard | kubernetes-dashboard-metrics-scraper-compat | 1.0.9-r10 |
| Chainguard | local-path-provisioner | 0.0.26-r2 |
| Chainguard | mage | 1.15.0-r4 |
| Chainguard | metrics-server | 0.6.4-r8 |
| Chainguard | nats | 0.1.1-r4 |
| Chainguard | nri-discovery-kubernetes | 1.7.2-r2 |
| Chainguard | nsc | 2.8.5-r1 |
| Chainguard | oras | 1.1.0-r4 |
| Chainguard | petname | 2.11-r3 |
| Chainguard | prometheus-adapter-fips-0.10 | 0.10.1-r2 |
| Chainguard | prometheus-beat-exporter-fips | 0.4.0-r1 |
| Chainguard | prometheus-bind-exporter | 0.7.0-r5 |
| Chainguard | prometheus-stackdriver-exporter | 0.14.1-r7 |
| Chainguard | prometheus-statsd-exporter-fips-0.22 | 0.22.8-r1 |
| Chainguard | protoc-gen-go-grpc | 1.3.0-r7 |
| Chainguard | render-template | 1.0.6-r1 |
| Chainguard | sbom-scorecard | 0.0.7-r6 |
| Chainguard | scorecard | 4.13.1-r1 |
| Chainguard | slsa-verifier | 2.4.1-r1 |
| Chainguard | smarter-device-manager | 1.20.11-r3 |
| Chainguard | smarter-device-manager-fips | 1.20.11-r2 |
| Chainguard | sonobuoy | 0.57.1-r1 |
| Chainguard | sops | 3.8.1-r1 |
| Chainguard | stakater-reloader-0.0.119 | 0.0.119-r4 |
| Chainguard | stakater-reloader-0.0.128 | 0.0.128-r3 |
| Chainguard | tigera-operator-1.28 | 1.28.15-r2 |
| Chainguard | tigera-operator-1.29 | 1.29.8-r1 |
| Chainguard | vertical-pod-autoscaler | 1.0.0-r2 |
| Chainguard | wait-for-port | 1.0.7-r1 |
| Debian 12 | golang-1.19 | no fix |
| Red Hat devtools 2023 | go-toolset-1.19-golang | 0:1.19.13-5.el7_9 |
| Red Hat devtools 2023 | go-toolset-1.19-golang-bin | 0:1.19.13-5.el7_9 |
| Red Hat devtools 2023 | go-toolset-1.19-golang-docs | 0:1.19.13-5.el7_9 |
| Red Hat devtools 2023 | go-toolset-1.19-golang-misc | 0:1.19.13-5.el7_9 |
| Red Hat devtools 2023 | go-toolset-1.19-golang-race | 0:1.19.13-5.el7_9 |
| Red Hat devtools 2023 | go-toolset-1.19-golang-src | 0:1.19.13-5.el7_9 |
| Red Hat devtools 2023 | go-toolset-1.19-golang-tests | 0:1.19.13-5.el7_9 |
| Red Hat Enterprise Linux 8 | delve | 0:1.20.2-1.module+el8.9.0+18926+5193682d |
| Red Hat Enterprise Linux 8 | delve-debuginfo | 0:1.20.2-1.module+el8.9.0+18926+5193682d |
| Red Hat Enterprise Linux 8 | delve-debugsource | 0:1.20.2-1.module+el8.9.0+18926+5193682d |
| Red Hat Enterprise Linux 8 | go-toolset | 0:1.20.12-1.module+el8.9.0+21033+5795bdf6 |
| Red Hat Enterprise Linux 8 | golang | 0:1.20.12-2.module+el8.9.0+21033+5795bdf6 |
| Red Hat Enterprise Linux 8 | golang-bin | 0:1.20.12-2.module+el8.9.0+21033+5795bdf6 |
| Red Hat Enterprise Linux 8 | golang-docs | 0:1.20.12-2.module+el8.9.0+21033+5795bdf6 |
| Red Hat Enterprise Linux 8 | golang-misc | 0:1.20.12-2.module+el8.9.0+21033+5795bdf6 |
| Red Hat Enterprise Linux 8 | golang-src | 0:1.20.12-2.module+el8.9.0+21033+5795bdf6 |
| Red Hat Enterprise Linux 8 | golang-tests | 0:1.20.12-2.module+el8.9.0+21033+5795bdf6 |
| Red Hat Enterprise Linux 9 | go-toolset | 0:1.20.12-1.el9_3 |
| Red Hat Enterprise Linux 9 | golang | 0:1.20.12-1.el9_3 |
| Red Hat Enterprise Linux 9 | golang-bin | 0:1.20.12-1.el9_3 |
| Red Hat Enterprise Linux 9 | golang-docs | 0:1.20.12-1.el9_3 |
| Red Hat Enterprise Linux 9 | golang-misc | 0:1.20.12-1.el9_3 |
| Red Hat Enterprise Linux 9 | golang-src | 0:1.20.12-1.el9_3 |
| Red Hat Enterprise Linux 9 | golang-tests | 0:1.20.12-1.el9_3 |
| SUSE Linux Enterprise Module for Development Tools 15 SP4 | go1.20 | 1.20.12-150000.1.35.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP4 | go1.20-openssl | 1.20.12.1-150000.1.17.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP4 | go1.21 | 1.21.5-150000.1.18.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP4 | go1.21-openssl | 1.21.5.1-150000.1.8.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP5 | go1.20 | 1.20.12-150000.1.35.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP5 | go1.20-openssl | 1.20.12.1-150000.1.17.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP5 | go1.21 | 1.21.5-150000.1.18.1 |
| SUSE Linux Enterprise Module for Development Tools 15 SP5 | go1.21-openssl | 1.21.5.1-150000.1.8.1 |
| Ubuntu 20.04 LTS | golang-1.20 | 1.20.3-1ubuntu0.1~20.04.1 |
| Ubuntu 20.04 LTS | golang-1.21 | 1.21.1-1~ubuntu20.04.2 |
| Ubuntu 22.04 LTS | golang-1.20 | 1.20.3-1ubuntu0.1~22.04.1 |
| Ubuntu 22.04 LTS | golang-1.21 | 1.21.1-1~ubuntu22.04.2 |
| Wolfi | aactl | 0.4.12-r5 |
| Wolfi | amass | 4.2.0-r3 |
| Wolfi | aws-flb-cloudwatch | 1.9.4-r6 |
| Wolfi | aws-flb-firehose | 1.7.2-r6 |
| Wolfi | aws-flb-kinesis | 1.10.2-r6 |
| Wolfi | cass-operator | 1.18.2-r3 |
| Wolfi | cni-plugins | 1.4.0-r1 |
| Wolfi | configmap-reload | 0.12.0-r3 |
| Wolfi | cortex | 1.16.0-r1 |
| Wolfi | ctop | 0.7.7-r10 |
| Wolfi | dgraph | 23.1.0-r4 |
| Wolfi | docker-cli | 24.0.6-r1 |
| Wolfi | docker-credential-ecr-login | 0.7.1-r8 |
| Wolfi | flannel-cni-plugin | 1.2.0-r5 |
| Wolfi | gke-gcloud-auth-plugin | 0.0.2-r6 |
| Wolfi | go-bindata | 3.1.3-r15 |
| Wolfi | go-licenses | 1.6.0-r8 |
| Wolfi | go-md2man | 2.0.3-r1 |
| Wolfi | gobuster | 3.6.0-r4 |
| Wolfi | gops | 0.3.28-r4 |
| Wolfi | gosu | 1.17-r2 |
| Wolfi | grpcurl | 1.8.9-r2 |
| Wolfi | helm-push | 0.10.4-r1 |
| Wolfi | hey | 0.1.4-r9 |
| Wolfi | hubble-ui-backend | 0.13.3-r1 |
| Wolfi | influx | 2.7.3-r8 |
| Wolfi | ip-masq-agent | 2.9.3-r6 |
| Wolfi | k3d | 5.6.0-r5 |
| Wolfi | katib-earlystopping | 0.19.0-r31 |
| Wolfi | katib-suggestion-goptuna-compat | no fix |
| Wolfi | katib-suggestion-hyperband | 0.19.0-r31 |
| Wolfi | katib-suggestion-hyperopt | 0.19.0-r40 |
| Wolfi | katib-suggestion-hyperopt | 0.19.0-r31 |
| Wolfi | katib-suggestion-nas-darts | 0.19.0-r31 |
| Wolfi | katib-suggestion-nas-enas | 0.19.0-r31 |
| Wolfi | katib-suggestion-optuna-enas | 0.19.0-r31 |
| Wolfi | katib-suggestion-pbt-enas | 0.19.0-r31 |
| Wolfi | katib-suggestion-skopt-enas | 0.19.0-r31 |
| Wolfi | katib-tfevent-metricscollector | 0.19.0-r31 |
| Wolfi | kind | 0.21.0-r0 |
| Wolfi | kubernetes-dashboard-metrics-scraper | 1.0.9-r10 |
| Wolfi | kubernetes-dashboard-metrics-scraper-compat | 1.0.9-r10 |
| Wolfi | local-path-provisioner | 0.0.26-r2 |
| Wolfi | mage | 1.15.0-r4 |
| Wolfi | metrics-server | 0.6.4-r8 |
| Wolfi | nats | 0.1.1-r4 |
| Wolfi | nri-discovery-kubernetes | 1.7.2-r2 |
| Wolfi | nsc | 2.8.5-r1 |
| Wolfi | oras | 1.1.0-r4 |
| Wolfi | petname | 2.11-r3 |
| Wolfi | protoc-gen-go-grpc | 1.3.0-r7 |
| Wolfi | render-template | 1.0.6-r1 |
| Wolfi | sbom-scorecard | 0.0.7-r6 |
| Wolfi | scorecard | 4.13.1-r1 |
| Wolfi | slsa-verifier | 2.4.1-r1 |
| Wolfi | smarter-device-manager | 1.20.11-r3 |
| Wolfi | sonobuoy | 0.57.1-r1 |
| Wolfi | sops | 3.8.1-r1 |
| Wolfi | vertical-pod-autoscaler | 1.0.0-r2 |
| Wolfi | wait-for-port | 1.0.7-r1 |
| openSUSE Leap 15.4 | go1.20 | 1.20.12-150000.1.35.1 |
| openSUSE Leap 15.4 | go1.20-openssl | 1.20.12.1-150000.1.17.1 |
| openSUSE Leap 15.4 | go1.21 | 1.21.5-150000.1.18.1 |
| openSUSE Leap 15.4 | go1.21-openssl | 1.21.5.1-150000.1.8.1 |
| openSUSE Leap 15.5 | go1.20 | 1.20.12-150000.1.35.1 |
| openSUSE Leap 15.5 | go1.20-openssl | 1.20.12.1-150000.1.17.1 |
| openSUSE Leap 15.5 | go1.21 | 1.21.5-150000.1.18.1 |
| openSUSE Leap 15.5 | go1.21-openssl | 1.21.5.1-150000.1.8.1 |
| openSUSE Tumbleweed | go1.20 | 1.20.12-1.1 |
| openSUSE Tumbleweed | go1.21 | 1.21.5-1.1 |